The remote web server contains a PHP application that is prone to directory traversal attacks. Description : 4Images is installed on the remote system. It is an image gallery management system. The installed application does not validate user-input passed in the 'template' variable of the 'index.php' file. This allows an attacker to execute directory traversal attacks and display the content of sensitive files on the system and possibly to execute arbitrary PHP code if he can write to local files through some other means.
Sanitize the 'index.php' file.
Updated on 2015-03-25
- Apache Struts ClassLoader Manipulation Vulnerabilities
- b2ePMS Multiple SQL Injection Vulnerabilities
- ASAS Server End User Self Service (EUSS) SQL Injection Vulnerability
- Apache Axis2 Document Type Declaration Processing Security Vulnerability
- ActualAnalyzer Lite 'ant' Cookie Parameter Remote Command Execution Vulnerability